What Cathay Pacific has said

Hong Kong's Cathay Pacific said on Friday 30 October that a breach at Amadeus, a Spanish travel software provider, had affected around 53,000 bookings. The airline stressed that its own systems and operations were not affected, drawing a clear line between its infrastructure and the supplier system where the unauthorised access occurred.

Most of the affected records involved booking references, passenger names and flight details, according to the airline's account of the Amadeus data. A smaller subset involved additional personal information, though the airline did not specify in the reported statement exactly what that extra information was. Cathay also said there was no evidence that financial or payment information had been accessed.

A wider supplier incident

Cathay is not the only airline to report an impact from the same supplier incident. Earlier in the same week, Japan Airlines said a similar breach had affected the data of 92,000 customers through unauthorised access to an Amadeus system, and South Korea's Asiana Airlines has also flagged customer data as compromised. The pattern points to a shared supplier exposure rather than a series of unrelated airline breaches.

Amadeus said it had become aware of a vulnerability affecting a travel booking display environment, and that it had taken steps to contain the incident and strengthen monitoring and detection on its systems. It added that investigations were ongoing and that there were no indications the vulnerability had been exploited for ransomware purposes. The company did not answer a question, reported by Reuters, about how many airlines and customers were affected in total.

What is still unclear

The affected Cathay bookings span August 2023 to September 2026, according to Amadeus data cited by the airline, which is a long window that may worry passengers who travelled years ago as well as recent ones. It is not yet clear from public statements how the vulnerability was first reached, whether any of the exposed data has been misused, or how many airlines in total are involved.

Passengers concerned about their booking should watch for direct communication from the airline and treat unexpected messages asking for personal or payment details with caution. The airline's statement gives no indication that customers need to take immediate action, but the investigation remains open and further detail may follow as Amadeus and the affected airlines complete their work.

Sources: Reuters